Dependency & Path Map / acme-use2

acct 123456789012 · us-east-2 · vpc-069cd5268c09419ce (10.20.64.0/18 + 2001:db8:1892:27fd::/56)

flow evidence 2026-09-08 14:24–16:45 UTC · 70,393 records · 60 parquet objects

10EC2 running
4ECS tasks
10/18stale AAAA
4single-point svc
6,974scan rejects
0NAT / LB
Colour nodes by
Layers
View

Edge semantics

healthy service call
resolves via stale DNS
blocked by security group
AWS API egress via EIGW
control-plane write
thickness ∝ flow count

Node health

critical — SPOF or ≥75% stale DNS
degraded — partial stale DNS
healthy
unregistered / external
2a   2b   2c

Cloud Map / Route 53 registration health — acme.use2.internal (Z7E83D4C17524B080F658)

servicerecordslivestaleblackhole

Registration is append‑only: acme-use2-svc-register runs every 5 min and adds current instance addresses to Cloud Map but never de-registers replaced ones. Flow logs date the two most recent replacements precisely — db‑replica cut over at 15:41 UTC and auth at 16:08 UTC; both predecessors still resolve. The app and db‑primary stale entries carried zero traffic across the whole 2h20m window, so they have been dead longer.

Evidence basis & limits

Built from live API reads: ec2 describe-*ecs describe-*servicediscovery list-*route53 list-*lambda get-*events list-rulesiam get-* plus 60 VPC flow-log Parquet objects from s3://acme-flowlogs-123456789012-us-east-2.
Not verified: CloudFormation APIs are denied by permissions boundary DemoAdminBoundary, so stack structure is inferred from aws:cloudformation:* resource tags (stack acme-use2) rather than read directly. No process-level or application-log inspection was performed, so service roles are inferred from listening ports and observed direction. Traffic conclusions describe the 14:24–16:45 UTC window only.